summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorNicolas Fort <nicolasfort1988@gmail.com>2023-02-27 20:11:35 +0000
committerNicolas Fort <nicolasfort1988@gmail.com>2023-02-28 14:19:52 +0000
commitbbfe6b54b58b68768f6427496d8ac3c1ef38da93 (patch)
tree201953efa1b8bcb4978d33342788eebb1c08a81c /src/conf_mode
parent4621cfc37a6088059d11c5adf2f33224e3435332 (diff)
downloadvyos-1x-bbfe6b54b58b68768f6427496d8ac3c1ef38da93.tar.gz
vyos-1x-bbfe6b54b58b68768f6427496d8ac3c1ef38da93.zip
T5037: Firewall: Add queue action and options to firewall
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/firewall.py9
1 files changed, 9 insertions, 0 deletions
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 20cf1ead1..b63ed4eb9 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -197,6 +197,15 @@ def verify_rule(firewall, rule_conf, ipv6):
if target not in dict_search_args(firewall, 'ipv6_name'):
raise ConfigError(f'Invalid jump-target. Firewall ipv6-name {target} does not exist on the system')
+ if 'queue_options' in rule_conf:
+ if 'queue' not in rule_conf['action']:
+ raise ConfigError('queue-options defined, but action queue needed and it is not defined')
+ if 'fanout' in rule_conf['queue_options'] and ('queue' not in rule_conf or '-' not in rule_conf['queue']):
+ raise ConfigError('queue-options fanout defined, then queue needs to be defined as a range')
+
+ if 'queue' in rule_conf and 'queue' not in rule_conf['action']:
+ raise ConfigError('queue defined, but action queue needed and it is not defined')
+
if 'fragment' in rule_conf:
if {'match_frag', 'match_non_frag'} <= set(rule_conf['fragment']):
raise ConfigError('Cannot specify both "match-frag" and "match-non-frag"')